►
Description
OpenID Connect 1.0 is one of the biggest security standards to come out in recent years, as it allows developers to simplify authentication, authorization, and identity management in an interoperable manner, but what many developers don’t know is that is crucial to understand how to properly integrate existing services and web applications to use this standard in a way that is easy to maintain. Jakarta EE 10, and its new version of the Jakarta Security specification now leverage the power of OpenID Connect providers in an intuitive manner, making Enterprise applications more adaptable to cloud environments.
This talk will focus on showcasing how this new integration is being implemented with a quick demonstration of how to implement a portable Jakarta EE application that connects to a valid OpenID Connect provider to leverage authentication and authorization services.
A
Foreign
and
welcome
to
another
Jakarta
Tech
talk,
my
name
is
Serena
joining
us
today
is
Fabio
teruso,
who
will
be
presenting
on
the
topic
of
open
ID
connect
has
finally
come
to
Jakarta
ee.
If
you
have
any
questions
for
Fabio
as
we
move
through,
today's
presentation
feel
free
to
drop
them
in
the
chat
or
the
ask
a
questions
tab
without
any
further
delay.
Fabio
over
to
you.
B
So
this
is
something
that
I
have
been
wanted
to
talk
about
since
Jakarta
E10
come
into
the
picture
in
one
of
these
specifications:
Jakarta
security
3.0-
that
is
a
specific
integration
with
this
technology,
which
has
taken
or
has
overtaken
a
lot
of
the
security
concerns
for
cloud
services
nowadays.
So
without
water
review,
let's
go
and
get
started
so
first
for
those
of
you
that
know
me,
I
am
father.
Rizzo
I
work
as
a
service
manager
for
prior
Services,
Limited
I
am
living
on
the
beautiful
city
of
Baron
Kia
on
Colombia.
B
At
the
moment,
it's
on
outside
we're
having
a
nice
weather
and
if,
in
any
case,
I've
been
working
with
payara
for
over
seven
years,
I
mostly
handle
everything
related
to
customer
success,
delivery
and
also
some
app
box
activities
on
conferences
and
online
talks
and
I
like
to
spread
the
world
around
our
products
and
of
Jakarta
and
all
the
similar
Technologies
and
para
services.
At
the
moment,
it's
an
expecting
member
of
the
eclipse
Foundation.
We
contribute
on
our
part
of
the
working
groups
for
both
Jakarta
and
micro
Eclipse
micro
profile.
B
Again,
our
Solutions
are
implementers
of
the
these
Technologies
and
we
like
contributing
to
them
in
they
have
our
customers
and
our
users
and
in
general,
what
we
do
try
is
to
keep
up
with
the
new
things
we
like
now.
The
Jakarta
has
become
this
faster
technology.
Now,
that's
part
of
the
of
the
community
to
contribute
more
to.
A
B
It's
focuses
on
giving
you
the
latest
things
that
are
implemented
for
this
standard
Technologies
and
allowing
you
to
hey
get
a
grip
on.
How
do
you
like
the
technology?
How
can
you
build
applications
on
it
and
once
you
are
scaling
your
particular
business?
Has
the
specific
needs
or
you
are
reaching
a
higher
user
base?
Then
you
should
consider
the
Enterprise
Edition,
which
is
built
for
a
scalable
and
available
production
environments.
B
So
deep,
Enterprise
Edition
is
also
optimized
for
critical
production
environments
in
an
environment,
either
Cloud
on
premises
on
a
hybrid.
If,
for
example,
you
would
like
to
run
your
installations
on
the
metal,
absolutely
that's
something
that
we
support.
If
you
are
running
them
on
popular
cloud
provider
like
Amazon
web.
B
Google
Cloud
platform
or
Microsoft
Azure,
then
we
support
all
of
those
cases
as
well
and
finally,
Enterprise
is
also
container
friendly.
So
if
you're
thinking
about
orchestration
needs-
and
you
want
to
deploy
your
application,
so
your
entire
environment
into
a
kubernetes
setup
using
a
document
set
of
images
and
that's
absolutely
the
case
that
is
supported
as
well
as
I
mentioned.
Enterprise
has
a
10
years
for
life
cycle
of
the
three
major
versions
of
VR,
supporting
the
moment:
inspiration,
4
version,
5
and
version
6..
B
Currently,
if
you
are
starting
a
project
or
not,
considering
developing
for
your
character,
you
will
recommend
version
6,
which
is
compatible
with
you,
have
11
and
17,
and
the
idea
is
adoration,
since
it's
fully
compatible
with
Jakarta
10.
for
our
customers,
we
also
have
the
Enterprise
Edition
being
compatible
backwards,
compatible
with
Jakarta
A8.
So
if
you
have
applications
or
a
particular
customer
has
applications
that
you.
A
B
Want
to
convert
to
these
new
standard
of
or
this
new
version
of
the
technology
you
can't
keep
running
then.
In
some
special
cases
you
will
have
to
do
some
conversions,
but
most
of
the
time
you
will
be
able
to
run
the
same
application
on
a
newer
version.
So,
let's
get
into
the
middle
of
the
top
10..
What
is
open
ID-
and
this
is
a
word
that
is
thrown
around
a
lot,
especially
when
security
concerns
has
discussed
a
modern
Cloud
environments
and
for
microservices.
An
open
ID
is
an
open
source.
Standalized
solution
for
two
important
things.
B
One
is
account
management
centralization.
The
challenge
that
many
security
or,
let's
not
just
simply,
focus
on
security
Engineers,
but
developers
and
operation
staff
have
to
worry
about,
is
how
to
properly
manage
the
data
of
users
for
their
specific
businesses
across
the
universes
of
applications
and
services
that
are
provided
for
them.
B
So,
for
example,
I
work
for
a
big
company
and
I'm
tasked
with
making
sure
that
hey
all
oral
applications
draw
in
data
for
a
centralized
instance,
or
are
they
actually
doing
their
own
thing
and
having
decentralized
data
spread
around
multiple
applications
in
different
formats
and
a
different
structure
and
following
different
password
management
policies,
or
maybe
a
specific
integration
with
external
providers,
or
things
like
that.
So,
instead
of
having
to
worry
about
that,
you
should
be
accommodating
a
centralized
solution
that
will
make
sure
that
account
management
is
following
a
single
point
of
value.
B
Another
important
thing
is
that
what
happens
when
these
applications
have
to
reuse
data
from
a
particular
user?
Do
you
ask
the
user
to
log
in
again?
Do
you
ask
them
to
create
a
new
account
and
copy
the
data
from
that
particular
previous
instance
to
the
new
one,
or
do
you
just
simply
draw
for
on
a
single
source
of
Truth?
In
that
case,
the
idea
is
that
you
don't
need
to
worry
about
that.
B
Everything
is
centralized
and
externalized
into
this
solution
that
will
allow
services
and
applications
to
grab
the
data
when
needed
and
to
that
effect,
open
ID
is
just
a
standard.
It's
just
a
set
of
specifications
that
tell
applications
and
services.
You
should
rely
on
identity
provider,
which
is
an
external
entity
that
will
host
and
protect
this
data
based
on
the
standards
and
will
allow
applications
to
talk
to
them
in
order
to
either.
B
Those
users
authorize
them
verify
that
those
users
are
who
they
say.
They
are
and
making
sure
that
when
they
need
the
data,
do
they
have
the
permissions
and
consent
from
the
actual
user
in
order
to
retrieve
this
data,
or
do
they
need
to
request
and
reconfigure
those
permissions
to
properly
draw
from
it
and
the
benefit
of
open
ID
is
that
since
it's
a
standard,
anyone
can
choose
an
identity
provider
to
the
needs?
B
Why
would
you
consider
open
ID,
because
again,
it
is
an
open
source.
All
of
these
standards
are
open,
they
are
on
the
web.
Anyone
can
read
about
them.
Any
open,
ID
provider
has
to
follow
them
and
they
have
to
certify
themselves
against
the
technology
in
the
sense
that
hey,
if
you
are
a
certified
open,
ID
provider,
that
means
that
you
are
following
this
Sunday
letter.
It
is
decentralized,
it
is
not
owned
by
any
entity.
It
is
a
community.
B
Anyone
can
join
the
European
ID
standard
community
and
contribute
to
it
or
questions
that
are
implemented
if,
in
the
case,
the
specific
processes
and
the
main
benefit
of
using
open
ID
is
that
it
frees
the
applications
and
websites
of
the
burdens
of
account
management.
So
if
you,
for
example,
are
developing
an
e-commerce
website
and
you
have
to
start
implementing
the
use
cases
and
business
cases
of
this
application,
the
first
thing
that
will
come
into
place
is:
okay
account
management.
What
do
we
want
to
do
about
it?
How
do
we
want
to
store
the
users?
B
Do
we
want
to
encrypted
information?
What
about
credit
card
data?
What
about
details
from
their
profiles
addresses
Etc?
So
in
that
particular
case,
you
don't
need
to
worry
about
it
because
it
can
be
externalized
to
the
open,
ID
provider.
In
that
case,
the
only
thing
that
this
application
would
have
to
worry
about
is
how
to
talk
to
that
open,
ID
provided
properly.
B
It
controls
how
users
profiles
are
shared,
and
the
idea
is
that
hey
when
you
are
sharing
this
data,
doing
in
a
control
Manner
and
finally,
as
a
user,
you
have
control
and
consent
of
the
data.
So
if
you
will
be
an
user
of
this
e-commerce
side-
and
you
say-
oh
no-
I
don't
want
to
give
my
use
my
account
to
anyone.
I
only
want
to,
or
to
this
particular
side
only
want
to
give
it
to
some
services.
B
So
you
have
been
online
for
the
last
10
years.
You
know
that
Google
Microsoft
Apple
and
make
metal
as
it
was
probably
known
as
Facebook.
These
are
companies
that
have
millions
of
services
I'm
on
social
media
and
around
cloud
services
as
well,
but
they
all
are
open.
Id
Implement,
those
technically
they
all
follow
the
sender.
So
if
you,
for
example,
wanted
to
use
any
of
this,
ask
the
recipient
or
storage
of
user
data
when
implementing
a
service,
you
can
do
that
and
there
are
solutions
in
the
market.
B
You
probably
have
seen
integration
with
Google
through
oauth,
which
is
on
a
standard
superset
of
let's
say,
solutions
for
user
management.
How
can
I
think
connect
disposing
and
also
at
the
moment,
then
you
could
do
that
you
could
just
simply
integrate
it.
Oh
I
know
instead
of
storing
user
accounts
on
my
service.
I
just
simply
want
to
give
a
Google
login
button
to
the
application
and
be
done
with
it,
and
that
mainly
because
this
technology
is
starting
implemented,
open
idea
and
has
standardized
in
the
numerals.
B
B
The
details
were
usually
left
to
vendors
so,
for
example,
pyara
or
weblogic
or
web
sphere,
or
Atomic
e
or
any
other
Java
e
band
or
other
time
wanted
to
implement
security.
The
standards
of
the
specifications
up
to
that
allow
some
basic
settings
and
some
basic
configurations
of
what
the
developer
could
do
in
order
to
tell
the
application
how
to
be
secure,
but
everything
else
have
to
be
done
by
the
vendor,
and
we
have
to
pick
up
the
slack
and
allow
defining
non-standard
solutions
to
developers
to
say
okay.
B
B
Next,
no
idea
go
read
the
documentation
from
ubendo
and
they
will
probably
tell
you
about
it,
but
the
specification
was
literally
hands
off
on
the
details,
so
Jakarta
security
Consolidated
all
of
this
solutions
and
introduced
proper
web-based
security,
because,
again,
nowadays,
services
are
focused
on
the
web
and
microservices
and
Cloud
native
applications
are
focused
around
web-based
security.
This
is
still
not
perfect.
B
Simplified
security
model
it's
well
oriented,
as
I
explained.
The
idea
is
that
if
you
are
interested
in
an
application
on
the
web-
and
you
want
to
tell
this-
is
how
your
users
are
going
to
authenticate
and
be
validated,
you
can
do
it
on
a
simplified
manner
and
introduced
to
the
main
concepts
are
something
called
an
authentication
mechanism
which
is
a
definition
inside
an
application
that
tells
the
user,
okay
or
or
that
tells
the
application.
This
is
how
users
are
going
to
authenticate
against
value
repository
of
data
and
the
identity
store.
B
B
Finally,
Jakarta
security
also
introduced
support
for
expression,
language,
which
is
another
specification
that
allows
users
to
introduce
on
dynamism
to
how
configuration
of
this
security
settings
is
done
on
the
application,
and
I
will
show
some
examples
a
bit
later.
So,
as
I
mentioned
all
of
this
about
open
ID
connect,
integration
is
brought
by
a
security
3.0.
It
introduces
open
ID,
connect
support.
B
It
was
mainly
the
big
feature
on
it
and,
along
with
it,
introducing
a
standard
ham
or
HTTP
authentication
mechanism
to
allow
users
and
developers
or
allow
developers
to
tell
users
how
they
are
going
to
be
authenticated
against
an
standard
identity
provider.
Then,
once
that
identities
is
validated,
the
state
and
of
that
session
is
either
configured
an
HTTP
session,
which
is
unstable
of
Jakarta,
since
the
serplete
specification
generally
tells
the
container.
B
In
that
case,
oh,
the
user
is
already
login
to
the
container
and
there
is
a
session
object
that
will
store
all
of
the
information
or
you
could
use
cookies
as
many
other
natural
Web
Solutions
to
nowadays.
And
finally,
what
jakart
security
also
3.0
also
introduced
is
a
mandatory
identity
store
for
token
validation.
That
means
that,
since
open
ID
connect
uses
standard
tokens,
you,
as
a
user
or
developer,
don't
have
to
worry
about
validating
these
tokens.
B
The
idea
is
that
the
container,
in
this
case
the
Jakarta
runtime,
will
do
that
for
you,
because
the
specification
requires
every
vendor
to
implement
this
identity
store,
so
open,
ID
connect
is
then
the
set
of
protocols
defined
by
open,
ID
again
open
ID
is
a
set
of
Standards
it
just
not.
It
does
not
only
open,
ID
connect.
It
also
contains
all
it
also
contains
open,
ID
Discovery.
It
also
connect
implements
everything
so
as
all
the
Technologies,
as
you
can
see
them
all,
does
in
there.
So
the
protocol
suit
is
an
interprow
Authentication
Protocol.
B
It
allows
technically
any
service
that
is
exposed
online
or
on
a
network
to
talk
to
the
provider
and
exchange
data,
and
the
idea
is
that
when
you
are
implementing
these
Services,
you
worry
about
something
called
assigning
flow.
The
idea
is
that
a
client
or
a
reliant
party
that,
in
behalf
of
the
user,
wants
to
authenticate
that
user
to
interact
with
the
services
we'll
tell
the
identity
provider.
Okay,
you
and
me
will
start
a
flow
of
data
exchange
between
each
other.
B
That
again
will
end
up
with
the
user
not
only
authenticated
but
ready
to
interact
with
your
services,
and
the
idea
is
that
that
exchange
happens
with
verifiable
assertions.
That
means
that
the
user
tells
you
I
am
this
user.
These
are
make
my
credentials.
The
identity
provider
says
okay,
yes,
you
are
who
you're
saying
to
be
now.
B
This
is
something
that
will
tell
the
rely
on
positive
and
they
will
give
me
something
in
return
in
order
to
continue
this
negotiation
in
a
sense
and
if,
in
the
case
that
you
need
to
go
beyond
what
is
implemented,
the
standard
is
extensible.
There
are
extensions
that
any
open
ID
connect
provider
can
Implement,
and
the
idea
is
that
many
of
them
now,
because
again
there
are
standards,
try
to
be
competitive
and
especially
online
solutions
that
try
to
externalize.
B
All
of
this
will
do
their
own
thing
and
Implement,
some
of
a
specific
features
like
oh
password,
passwordless,
login
or
integration
with
multi-factor,
authentication
or
stuff,
like
that,
and
some
of
the
popular
solutions
for
open
ID
connect
Platforms
in
the
Market
at
this
four.
If
you
were
with
me
a
few
months
ago,
I
did
a
talk
on
integration
with
key
clock,
but
I
also
done
in
the
past
talks
about
integration,
with
old,
zero
and
OCTA
in
Jakarta
micro
profile,
and
the
idea
is
that
you
you
choose.
Whatever
suits
you.
B
I'll
see,
you
are
not
our
online
services.
That
means
that
they
have
various
degrees
of
plans
and
tiers
that
you
can
either
do
for
free
or
pay
money
to
the
provider
in
order
for
you
to
externalize
the
management
of
user
data.
But
if
you
don't
want
to
rely
on
a
third-party
service,
you
can
Implement
your
own
solution
using
either
Force
work
or
Key
Club,
which
are
fully
on-premise
Solutions.
So
you
can
integrate
and
you
can
configure
the
management
of
the
database
and
information
and
everything
around
it.
B
It
means
some
extra
steps
and
some
extra
concerns
for
you.
But
again
it
depends
on
how
trustful
you
are
of
the
services
and
how
much
you
want
to
dedicate
on
time
and
setting
them
up
and
all
of
it
so
open.
Id
authorization
is
focused
around
two
things.
One
data
is
exchange
through
tokens.
There
are
three
types
of
tokens
managed
by
every
open,
ID
solution,
the
access
tokens
which
tells
an
user
okay.
You
have
been
granted
access
in
behalf
of
this
service.
B
B
I
have
verified,
who
you
say
you
are
these
identity
token
will
tell
services
and
applications
all
of
your
information,
your
name,
your
email,
specific
email
addresses
or
a
specific
identity
code
verifications
which
profiles
have
you
access
to
which
roles
is
your
user
or
does
belong
to
or
at
specific
groups,
and
things
like
that
and
that
identity
token
also
has
an
expiration
date.
Because
again
your
data
can
change
or
can
be
revoke
at
some
point,
then,
finally,
a
refresh
token,
which
is
used
in
conjunction
with
the
access
token
for
offline
access.
B
So
let's
say,
for
example,
that
a
service
says
I
don't
want
to
request
a
new
access
token
after
it
expires,
for
like
the
example
an
hour,
then,
instead
of
requesting
a
new
access
token
through
our
re-logging
in
to
the
platform,
you
can
just
say
give
me
a
refresh
token.
I
was
given
this
one.
This
will
allow
me
to
request
for
a
new
access
token,
a
new
refresh
token
and
I.
Can
click
continue
asking
for
Access
tokens
to
be
refreshed
as
long
as
this
token
is
valid?
B
So,
along
with
these
three
tokens,
there
are
basic
types
of
crans
and
all
of
these
are
based
on
all
two,
which
is
a
superset
of
the
protocol.
These
are
the
authorization,
Grant
implicit,
a
password
credentials
and
client
credentials
for
the
purposes
of
this
demonstration,
and
this
talk
will
only
be
focusing
on
the
authorization
Grant,
which
is
a
default
workflow.
How
open
ID
connect
works
and
the
basic
process
is
a
seven
step
process.
It
begins
with
the
end
user,
navigating
to
a
website
or
a
web
application.
B
Then
that
user
says
I
want
to
sign
in
and
then
gives
their
credentials
again.
The
process
states
that
they
can
give
the
username
and
password,
but
this
credentials
can
be
also
a
token.
They
can
also
be
a
one-time
password
code
or
a
time
one
time
password
code
or
they
could
be
login
through
a
biometric
device
or
it
could
be
a
verification
for
camera.
B
Things
like
that
how
the
user
identifies
their
credentials
with
the
open
ID
provider
as
up
to
the
provider
configuration
then
the
client,
or
in
this
case
the
Reliant
party,
will
send
a
request
to
the
open
ID
provider
telling
them
okay,
the
user
is
going
to
be
signing
in
authenticate
and
place.
The
in
this
case,
open
ID
provider
will
authenticate
that
and
obtains
authorization,
and
then
it
will
respond
with
an
identity
token
and
use
an
access
token.
B
You
can,
depending
on
the
type
of
flow
that
you're
using,
can
get
both
at
once,
can
get
only
one
or
can
get
one
with
the
refresh
token
as
well.
By
default,
how
open
ID
connect
works
for
Jakarta
is
that
you
get
access,
token
identity,
token
and
you
have
to
configure
European
ID
provided
to
get
the
refresh
token.
Finally,
you
can
send
a
request
to
the
access
token
to
the
user
device
by
the
relying
party
and
that's
how
that
user
gets
authenticated.
B
Additionally
the
open,
ID
provider
has
something
called
the
user
info
and
point
that
gives
you
additional
details
about
the
identity
and
configuration
of
the
user
profile
as
well.
So
in
that
sense
the
authorization
Grant
flow
Works
in
really
easy
exchanges
and
assertions.
As
we
discussed,
the
user
initiates,
the
authentication
to
the
relying
party
relying
party
sends
their
request
to
the
provider,
then
the
provider
and
the
user
authenticate.
The
idea
is
that
again,
it
could
be
either
through
password
credentials,
multi-factor
authentication,
using
codes
or
tokens
or
whatnot
or
biometric
Solutions.
B
Once
that
is
successful,
the
identity
provider
will
send
an
authorization
code
to
the
Reliant
party
and
then
the
idea
is
that
relying
party
can
redirect
to
the
original
resource.
So,
for
example,
my
application
was
redirected
to
a
mobile
site
and
then
I
want
to
go
back
to
what
I
was
doing
before
authentication.
The
relying
party
should
take
that
into
account
once
that
is
done,
then
the
line
party
will
tell
the
provider
give
me
the
access
and
ID
token.
B
Please,
because
we
already
have
verified
that
through
the
authorization
code
once
that
is
done
in
order
to
validate
these
tokens,
because
again,
these
tokens
could
be
compromised
in
the
middle.
There
needs
to
be
a
retrieval
of
something
called
the
JW
keys
or
a
specific
key
store
solution,
or
a
key
set
solution
that
will
be
given
by
the
provider
to
tell
the
Reliant
party.
Okay,
these
are
signature,
keys
that
you
can
use
to
verify
the
Integrity
of
these
tokens.
So
if
those
tokens
haven't
been
affected
on
the.
A
B
So,
as
we
mentioned,
security
introduced
this
authentication
mechanism
definition,
which
is
an
extension
of
HTTP
authentication
mechanism,
called
open,
ID
authentication
mechanism
where
you
can
configure
all
of
the
settings
for
your
ID
provider.
Interestingly,
there
are
some
basic
details
in
here:
each
application
must
provide
something
called
a
client,
ID
and
a
secret,
and
these
are
Staples
of
the
protocol.
These
are
usually
given
to
you
by
your
provider.
The
ID
is
then
identified
of
the
application
that
it's,
oh
sorry,
that
is
initiating
the
process.
B
The
security
usual
secret
key
that
should
be
rotated
every
now
and
then,
in
order
to
prevent
you
know,
breaches
and
making
sure
that
services
are
not
compromised.
Then
there's
a
redirect
URI
that
will
tell
the
provider
okay,
once
authentication
is
complete.
You
will
return
to
this
webpage
on
the
original.
Relying
party
flow
in
this
case
will
be
the
web
application
and
by
default
Jakarta
security
introduced.
B
This
placeholder
called
base
URL
that
will
inject
the
base
URL
of
the
application,
one
is
deployed
on
the
runtime
and
finally,
you
have
to
give
a
provider
Yuri,
because
all
of
this
information
of
how
to
communicate
with
open
ID
provider,
it's
an
extender
endpoint
each
provider
must
introduce
these
details
on
the
that
well-known
slash,
open,
ID
configuration
endpoint.
If
a
provider
doesn't
give
you
this,
then
technically
is
non-openid
compatible,
because
this
is
a
requirement
by
the
specification
Additionally.
B
You
can't
configure
logout
Behavior
what
happens
when
the
application
logs
out,
and
in
that
case,
what
Jakarta
introduced
through
the
open,
ID
authentication
mechanism,
it's
a
radical
direct
urine.
What
you
want
to
do
when
the
service
logs
out?
Okay,
you
want
to
redirect
you
on
a
specific
equation.
You
can
do
that.
All
of
this
can
be
defined
on
a
CDI
brain
or
another
Jakarta
component
by
preference.
B
Usually
it
is
recommended
to
be
put
on
the
CDI
application
skill
plane
and
be
done
with
it
so
avoid
discuss
security,
also
introduced
extension,
language
symbol,
the
expression
language
supports
correct,
and
the
idea
is
that
you
can
configure
these
values
in
a
dynamic
way
using
expression,
language,
and
all
of
these
will
point
to
your
specific
beans
that
leave
either
on
the
application
or
nor
additional
Scopes.
So,
for
example,
you
don't
want
these
details
to
be
exposed
on
the
API
and
on
the
code
as
well.
B
You
can
just
simply
give
you
this
on
a
CDI
pin
that
retrieves
them
from
a
database
information
or
on
a
CDI
bin
diabetes
in
front
of
a
file,
or
maybe
you
can
use
additional
apis
and
extract
this
information
from
a
centralized
configuration
repository.
So
this
will
simplify
the
configuration
and
also
make
it
more
resilient.
B
So
what
are
the
basic
meta
data
that
you
have
to
configure
the
provider
endpoint?
This
is
mandated
by
the
specification
you
have
to
provide
the
authorization
endpoint,
the
token
endpoint,
the
JW
Keys
UE.
But
again,
all
of
these
details
are
not
configuring.
Here
they
are
configured
to
the
provider
Yuri.
That
will
have
all
of
that
information
who
is
issuing
the
tokens?
What
are
the
supported
types?
What
are
the
supported
response
time,
unsupported
ID
token,
signing
algorithms?
B
What
is
the
name
of
the
application
or
the
service
that
is
execute
in
all
of
the
process,
a
product
value
that
will
establish
how
the
login
will
be
done
by
the
provider?
It
can
either
be
the
login
which
will
foresee
application
to
log
in
each
time
that
you
are
initiated
in
this
process,
because
some
providers
will
allow
single
sign-on
you
log
in
once,
and
then
your
login
absolutely
for
that
specific
Universe
of
data.
You
don't
have
to
login
each
time
that
you
are
initiating
the
Services.
B
There
is
also
consent
that
will
request
consent
for
the
user,
for
this
specific
configuration
or
that
you
are
requesting
by
definition,
each
open
ID
provider
can
also
Define
how
consent
is
requested,
depending
of
the
permissions
that
the
application
is
requesting
on
behalf
of
the
user,
also
like
account
that
would
allow
anything
in
this
case.
If
a
user
has
multiple
accounts
and
they
want
to
switch
accounts
between
a
login
process,
they
can
do
that
as
well.
There
are
some
extra
parameters
that
you
can
also
configure.
B
B
The
idea
is
that
the
token
is
given
by
the
provider
and
the
other
in
the
relying
policy
must
make
sure
that
all
of
these
validations
are
completed,
because
otherwise
they
could
be
either
a
process
or
some
misconfiguration
on
the
authentication
process
or
the
token
could
have
been
compromised
and,
as
we
mentioned,
the
main
one
is
just
making
sure
that
the
token
has
not
expired,
because
all
of
these
assertions
are
done
for
a
specific
amount
of
time.
Initially,
identity
providers
do
not
go
longer
than
one
hour
validation
for
an
access
token.
B
B
When
you
retrieve
the
token
from
the
provider,
there
will
be
a
claim
in
there.
A
claim
is
just
an
attribute
on
the
Json
web
token.
That
will
let
the
airline
part,
you
know,
groups
for
the
the
the
user
or
the
identity
belongs
to
are
in
this
particular
claim,
and
is
the
responsibility
of
the
provider
to
be
confused
in
such
a
way
that
these
groups
would
be
retrieved
so,
finally,
how
the
application
is
configured
to
low
users
to
access
resources?
This
is
something
of
a
staple
of
things.
B
A
B
Map
automatically
to
the
groups
that
are
retrieved
from
the
Json
web
token,
so
this
hasn't
changed
as
I
mentioned.
The
specification
is
still
not
perfect
in
the
future.
I
hope
that
this
is
simplified
to
your
annotation
model
and
I
know
that
there
are
some
work
that
has
been
done,
but
for
the
moment
I
have
to
work
with
it
and
configure
the
security
constraints
through
this
means.
Okay.
B
So
having
said
about,
all
of
that,
I
will
show
you
a
quick
demo
and
it
is
on
GitHub
on
the
my
user
account
conference
demo
and
it's
on
the
branch
check
out.
It's
an
update
because
the
main
one
at
the
moment
is
a
bit
out
of
side,
so
I'm
working
on
that
on
this
separate
Branch,
so
to
Showcase
that
let
me
go
and
show
you
here:
let's
enter
presentation,
mode,
presentation,
mode,
okay,
so
what
we
have
now
it's
a
multimodial
project.
A
B
Application
that
handles
conference
talks
and
I
like
to
do
this
as
part
of
my
presentations
just
to
keep
the
thing
consistent
and
the
multi-module
is
composed
of
four
modules:
a
dashboard
module,
which
is
the
application,
a
web-based
UI
that
will
integrate
with
this
all
the
services.
There
are
three
services,
one
that
handles
the
sessions
or
the
talks
that
will
be
done
on
the
conference
and
all
that
handles
the
speakers
and
then
all
the
handles
built-in
and
rating
these
sessions.
A
B
Session
service
and
all
of
these
are
implemented
using
Empire
micro.
So
let
me
go
just
quickly
to
the
service
to
the
speaker
service.
You
can
see
that
it
uses
the
fire
up
micro,
Maven
plugin,
in
order
to
run
by
a
micro
instance.
It
is
a
parameters,
it's
just
a
jar
file
that
is
compatible
with
Jakarta
web
profile.
It
will
deploy
the
application
on
a
specific
port
and
it
will
initiate
a
cluster
within
a
specific
name,
not
to
clash
with
the
other
services.
B
Pretty
simple,
and
once
the
service
is
run,
it
will
deploy
a
set
of
influence.
The
labels
in
a
bit
show
here.
Upload
of
them
are
starting,
so
we
can
give
them
a
few
more
seconds
until
they're
ready,
but
in
the
meantime,
what
else
you
have
to
consider
is
that
the
services
are
configured
to
run
on
the
these
and
pump
file
and
it
defines
the
Jakarta
platform,
the
web
API
profile
and
it
uses
version
10.0.
B
All
of
these
services
are
running
on
Java
11
and
also
you
can
see
that
I'm
using
micro
profile,
which
is
an
extension,
an
additional
set
of
apis
in
order
to
integrate
some
specific
features
that
I'd
like
to
Showcase
okay,
so
my
speaker
service
has
run
the
same
one
with
the
same
thing
with
my
session
service.
All
of
those
are
ready
good
to
go.
Let's
go
to
the
crops
of
the
thing,
which
is
a
dashboard
service.
So
this
application
again
it's
a
simple
application.
It's
confused
to
run
the.
A
B
Have
an
open,
ID,
authentication
mechanism
definition.
It
requires
a
client
ID,
a
client
secret
I'd,
rather
accurate,
that
has
a
changeable
for
the
director
user
to
this
index.
X
HTML
and
this
application
is
using
for
the
purposes
of
integrating
with
jakartai
Java
or
Jakarta
server
faces
or
Jakarta
faces,
which
is
a
new
name
of
the
specification
to
implement
the
user
interface.
So
I'm,
also
using
parentheses
because
Prime
faces
is
a
good
extension
to
use,
and
it's
pretty
simple.
B
You
can
see
that
the
index
page
or
the
landing
page
of
the
application
is
implemented
using
a
Jakarta
faces
composition.
It
uses
this
main
template
and
everything
is
configured
in
the
way
that
if
you
are
familiar
with
JSF,
you
will
understand
this
now
now.
What
else
there
is
a
configuration
in
here
called
the
jws
ks
read
timeout
and
connection
timeout.
That
will
tell
the
runtime.
This
is
how
long
you
need
to
wait
when
reading
this
files,
because
again
these
are
files
that
are
located
on
the
internet.
B
Sometimes
it
can
take
longer
and
for
the
purposes
of
this
demonstration
they
provider
that
I
choose
to
be
used.
It's
a
out
zero.
So
in
node
zero.
This
is
something
that
I'll
have
to
show.
I
have
configured
this
fire
at
fan
and
again
this
is
a
development
tenant.
This
is
not
using
production
in
any
way
and
I
have
configured
an
application
that
corresponds
to
that
dashboard
and
I
named
that
conference.
Demo,
a
JSF
application
in
here
you'll
see
that
the
configuration
of
the
application
on
node
0
will
give
me
my
client
ID.
B
And
I
also
have
to
give
you.
This
is
something
that
you
have
to
do
in
every
open,
ID
provider,
a
ballot
list
of
callback
URLs,
because
again
the
communication
starts
from
the
relying
party
which,
in
this
case
is
the
application.
This
will
redirect
to
the
open
ID
connect
provider,
login
page
and
then
we'll
redirect
back.
You
have
to
authorize
the
application
to
redirect
to
these
URLs,
otherwise
it
will
be
denied
and
the
provider
won't
even
allow
you
to
do
the
login
because
anyone
could
initiate,
if
that
is
the
case,
a
login
process.
B
Finally,
the
only
thing
that
I
have
to
show
in
here
is
that
the
by
default,
the
grand
types
that
this
application
allows
is
implicit
authorization
code
refresh
token
and
client
credentials,
but
refresh
tokens
will
allow
the
service
to
grant
me
refresh
tokens
whenever
an
application,
authenticates
and
the
authorization
code
is
the
default.
Authorization
run
that
we
have
to
show
now.
What
what's
on?
B
Oh,
no,
a
set
of
basic
users
for
these
conference
application,
so
there
are
two
users:
I
call
Alpha,
Carol
beta
or
both
of
them
are
just
dummy
users
that
I
have
created,
and
the
idea
is
that
we
have
configured
this
under
specific
roles.
In
this
case,
there
are
three
types
of
roles:
an
admin
role
which
are
conference,
administrators
and
athend,
which
attend
to
the
conference
and
speaker
which
are
speakers
on
the
conference.
So
in
this
case,
Michael
is
part
of
the
ascendian
speaker
roles
and
the
other
user.
B
B
The
API
has
to
be
configured
on
odd
0
as
well,
and
let
me
show
that
here
quickly,
if
I
go
on
the
applications
apis,
you
will
see
that
there
is
a
prior
micro
Services
conference
API,
and
it
belongs
to
this
specific
identifier.
Https
colon,
slash,
API
dot
via
adapt
fish
for
this
info.
So
you
have
to
give
this
audience
because
otherwise
there
is,
if
you
don't
provide
that
the
tokens
that
you
will
be
granted
to.
You
cannot
be
used
to
authenticate
users
in
behalf
of
the
services
that
you
want
to
Connect
Now.
B
B
You
can
see
that
this
is
what
I
obtain
for
the
open
ID
configuration
endpoint.
It
is
adjacent
with
all
of
the
details
that
the
provider
allows
and
is
used
to.
So
there
is
a
token
endpoint,
an
authorization
point,
a
device
authorization
input.
All
of
these
are
part
of
the
open,
ID
connect
standard,
I,
jwks
Yuri.
What
the
keys
are
held,
a
registration
endpoint
if
you
want
to
allow
users
to
register
themselves
a
set
of
Scopes,
and
these
are
Staples
of
open
ID
as
well.
A
B
I
can
allow
this
case
the
talks
to
our
configure,
the
admin,
the
speaker
and
the
attend
the
row.
So,
in
those
cases,
I
have
configured
these
roles
as
well.
Okay,
addition
I
want
to
tell
my
application
that
these
are
the
three
roles
and
only
the
three
roles
that
I'm
using
just
for
the
sake
of
completeness.
B
Finally,
it
is
important
the
way
that
this
is
configured
is
that
once
you
obtain
The
annotation
configuration
of
this,
how
did
you
tell
the
application
to
log
in
so
I
have
configured
our
own
out
controller?
This
is
a
CDI
pin
that
is
used
by
the
web
page
on
the
web
UI,
and
it
has
a
login
method
that
will
trigger
the
security
contact,
dot,
authenticate
method
and,
in
this
case,
the
security
context.
B
I,
just
simply
call
authenticate
I
need
to
pass
over
the
request
and
the
response
for
the
corresponding
with
communication,
and
you
can
obtain
those
on
JSF
very
simply
using
the
faces
contest,
get
dot,
get
current
instance,
get
external
context,
get
requests
and
get
response,
and
that's
it
and
I
also
have
to
pass
a
set
of
authentication
parameters
if
I
want
to
modify
how
the
authentication
is
done,
but
I
I'm
content
with
just
doing
the
basic
authentication
for
the
logout.
It's
similar.
B
A
B
A
B
Started
and
the
application
is
ready,
so
this
application
is
deployed
on
882
dashboard
and
in
here
once
I
click,
the
sign
in
button.
You
will
hear
you
will
see
that
I
am
redirected
to
the
old
c
row.
Authentication
page,
oh
I
was
automatically
login.
So
let
me
log
out-
and
let
me
sign
in
again,
hopefully
I'll
be
redirected.
No
I'm
still
logging,
oh
because
I
am
not
forcing
the
application
to
alerting
me
in
again.
B
This
is
an
interesting
configuration,
but
you
can
see
that
once
I'm
redirected
I'm
getting
the
authorization
code
that
is
part
of
the
process,
so
how
we
want
to
test
it
or
how
I
want
to
reconfigure
this
or
we
can
see
what's
happening
with
the
configuration
or
the
login
process.
Is
we
can
tell
okay
the
authentication
mechanism
definition
that
I
want
to
log
in
each
time?
So
I
do
this
using
the
prompt
configuration
and
the
prompt
will
be
login,
so
State
there?
B
B
If
I
didn't
want
to
do
this
with
my
yakata
runtime
I
could
technically
do
this
using
standard
HTTP
rest
service
integration
through
our
client
and,
in
this
case
I'm
using
Postman.
So
these
URL
that
I
have
configured
it's
exactly
what
the
application
does.
So,
if
I
initiate
this,
you
can
see
that
I'm
getting
a
200
okay
and
what
I'm
getting
is
a
web
page
for
the
login
initiated
by
our
zero,
and
this
is
what
I
should
be
doing
in
the
application.
B
So
if
I
went
and
get
back,
I
would
get
a
code
and
that
code
I
can
use
that
in
here
to
exchange.
For
the
token,
so
once
the
token
is
done-
and
you
can
see
that
this
is
a
standard
path
provided
by
Alt
zero
again,
this
part
of
the
open
ID
configuration
the
same
thing
for
the
authorized
endpoint
and
once
the
access
token
is
once
the
access
token
is
given
to
me.
I
will
be
given
that
and
the
ID
token
as
well.
So,
okay,
the
application,
is
ready.
Let's
retest
this,
let's
refresh.
B
B
And
now
on,
login,
again
and
I
can
execute
the
operations,
and
you
can
see
here
that
I'm
getting
the
code
back
and
an
estate,
your
state
is
using
internally,
but
the
Reliant
party
and
the
identity
provided
to
also
do
an
additional
verification
to
make
sure
that
everything
is
in
place.
I
can
call
the
speaker's
endpoint.
In
that
case,
I
can
just
simply
go.
A
B
Example,
CEO
as
an
example
save
it
and
I
can
execute
this
operation
because
the
user
has
been
officially
authenticated.
So
it's
very
simple.
The
only
thing
that
I
have
configured
on
my
application
is
this:
making
sure
that
the
user
it's
properly
and
the
application
knows
where
to
find
all
of
this
data,
and
everything
else
is
done
by
the
open,
ID
provided.
One
thing
is
that
you
can
also
get
some
additional
things.
You
can
see
that
on
the
login
page
you
can
see
the
email
of
the
user.
What
is
that
email?
B
So
that
is
configured
using
the
open,
ID
context,
and
this
is
an
additional
annotation
that
you
can
use,
because
this
is
available
if
you
use
the
open,
ID
authentication
mechanism.
So
once
the
user
is
authenticated
technically
you
can
retrieve
the
claims
of
that
user.
That
means
the
data
and
the
name
of
that
particular
user.
So
in
this
case
the
name
would
be
assigned
by
default
by
open
ID
to
the
email
address.
B
I
could
reconfigure
that,
on
the
specific
claim
on
the
open,
ID
configuration
of
the
tokens
on
out
zero,
but
if
you
want
you
can
go
the
extra
mile
and
you
could
technically
get
those
using
the
identity
token.
So,
for
example,
ID
token,
in
this
case,
I
can
just
simply
say
open,
ID
context,
get
claim
sorry
get
identity
token
and
the
id2
can
give
me
additional
details
like
the
in.
B
Claim
or
you
could
get
the
token
itself
and
validated
or
extract
the
details
as
usual,
so
you
also
have
access
to
that
from
the
API
API.
So
to
cap
it
off.
Unfortunately,
I
don't
have
enough
time,
but
I
also
wanted
to
talk
a
bit
about
para
Cloud,
which
is
a
Jakarta
managed
Solutions
on
the
cloud
that
we
have
as
well.
The
idea
is
that
you
can
just
simply
grab
a
calculator
application
and
deploy
it
quickly
and
showcase.
It.
B
Area
is
that
better
Cloud
runs
with
the
help
of
kubernetes
and
Docker
files
in
order
to
quickly
integrate
the
Run
environment
that
you
will
have
if
you
implemented
all
of
this
by
yourself,
and
the
benefits
is
that
you
can
deploy
this
easily.
Let
me
see
if
I
can
do
this
quickly
under
a
minute
if
I
go
to
pair.
A
B
B
B
This
I
could
just
simply
go
and
click
on
the
dashboard
and
have
similarly
the
same
application
running.
Oh,
it's
good
everything
is
working,
you
can
use,
go
ahead,
okay
and
now
it's
failing,
because
I
haven't
Recon
for
you
on
the
Callback
hero,
but
it
it
mostly
the
so
where
a
cloud
is
running
a
free
trial
for
15
days,
so
my
and
I
would
encourage
people
to
just
simply
go
and
access
it.
B
A
You
for
that
excellent
presentation
today,
Fabio
So,
currently
right
now
there
isn't
any
but
I
do
encourage
anyone
in
the
audience
to
feel
free
to
ask
any
final
questions.
You
could
do
so
in
the
chat
or
in
the
ask
a
questions,
Tab
and,
of
course,
a
reminder
that
we're
always
looking
to
book
some
more
Jakarta
Tech
talks
through
2023.
We
do
have
some
slots
available.
This
fall,
so
we
highly
encourage
you
to
do
that.
A
I
did
link
the
form
in
the
chat
and
finally,
if
you
do
have
any
feedback
for
this
Tech
talk
program
in
specific
we'd
love
to
hear
from
you.
So
just
click
on
the
green
button
when
we
close
out
this
webinar
session-
and
let
us
know
how
you
enjoyed
the
talk
so
I'll
just
take
another
quick
look:
Fabio
in
the
ask
a
questions,
tab
and
or
in
the
chat.
So
I
don't
see
any
questions,
but
that's
that's
it.
So.